CVE-2026-69190
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
- Record
CVE-2026-69190- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-639, CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-84038
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
- Record
EUVD-2026-84038- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m9c2-85gv-8xr5
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Impact
A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or to remove the original owner's access.
Patches
This issue has been patched in the following Graylog versions: 6.3.14, 7.0.9, 7.1.4. Affected users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workaround
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to Jan Kahmen, turingpoint for reporting.
- Record
GHSA-m9c2-85gv-8xr5- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-639, CWE-862
- Updated
- 2026-11-02
NVD
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
- Record
CVE-2026-69190- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-639, CWE-862
- Updated
- 2026-11-02
OSV
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.
- Record
CVE-2026-69190- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-639, CWE-862
- Updated
- 2026-11-02
OSVGHSA-m9c2-85gv-8xr5
Graylog: Manager-to-Owner privilege escalation on saved searches and dashboards
Impact
A vulnerability was found in Graylog's API endpoint for updating saved searches and dashboards. A user with edit permissions on a dashboard or saved search could grant owner permissions to an arbitrary account, which could then be used to delete the respective saved search or dashboard or to remove the original owner's access.
Patches
This issue has been patched in the following Graylog versions: 6.3.14, 7.0.9, 7.1.4. Affected users should upgrade to one of these versions or above to remediate the vulnerability.
Graylog Cloud has already been patched.
Workaround
There is no known workaround. Upgrading to a patched version is recommended.
Credits
Thanks to Jan Kahmen, turingpoint for reporting.
- Record
GHSA-m9c2-85gv-8xr5- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-639, CWE-862
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.graylog2:graylog2-serverMaven |
6.3.0 up to 6.3.14 | 6.3.14 |
org.graylog2:graylog2-serverMaven |
7.0.0 up to 7.0.9 | 7.0.9 |
org.graylog2:graylog2-serverMaven |
7.1.0 up to 7.1.4 | 7.1.4 |
org.graylog2:graylog2-serverMaven |
6.3.0 up to 6.3.14, plus listed versions 6.3.16.3.106.3.116.3.126.3.13 Show 7 moreShow less6.3.26.3.36.3.46.3.56.3.76.3.86.3.9 |
6.3.14 |
org.graylog2:graylog2-serverMaven |
7.0.0 up to 7.0.9, plus listed versions 7.0.17.0.27.0.37.0.47.0.57.0.67.0.77.0.8 |
7.0.9 |
org.graylog2:graylog2-serverMaven |
7.1.0 up to 7.1.4, plus listed versions 7.1.17.1.27.1.3 |
7.1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-69190 is a medium vulnerability (CVSS 6.3) in Graylog2 Graylog2-server, published September 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in org.graylog2:graylog2-server 6.3.14.
References
github.com/Graylog2/graylog2-server/security/advisories/GHSA-m9c2-85gv-8xr5
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-69190